CVE Feed

    Dashboard / CVE / CVE-2026-69227

    CVE-2026-69227

    A flaw in Portal for ArcGIS allows unauthenticated access to certain Portal Administrator API endpoints under specific conditions. This could enable an attacker to access administrative functionality that should require authentication.

    Published:Oct 13, 2026
    Last Modified:Oct 14, 2026
    EPS:Oct 13, 2026
    EPSS Score:0.00326
    CVSS Score:9.8

    Affected Products

    Vendor
    Esri
    Product
    Portal For Arcgis

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-69226 (CVSS 6.5) — A flaw in Portal for ArcGIS allows unauthenticated users to create new accounts through the sharing endpoint e…
    CVE-2026-10759 (CVSS 5.5) — A flaw in Portal for ArcGIS could allow LDAP injection through administrative functionality that constructs Ac…
    CVE-2026-69233 (CVSS 5.5) — There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow …
    CVE-2026-69234 (CVSS 6.1) — There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 11.5 and prior whic…
    CVE-2026-69235 (CVSS 6.1) — There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow …
    CVE-2026-69236 (CVSS 6.1) — There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 12.1 and prior that may allow …
    CVE-2026-69237 (CVSS 3.8) — There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.3 and prior that allows a remot…
    CVE-2026-69232 (CVSS 5.5) — There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow …
    CVE-2026-69231 (CVSS 5.5) — There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow …
    CVE-2026-69230 (CVSS 5.5) — There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-69227 — Esri (Critical 9.8) | CVE-DB